macOS xattr quarantine removal from /tmp staged payload

Emiliano Mema@Nosalva

•updated Aug 26, 2026•0•0•2

This rule detects the use of the 'xattr' utility to remove the 'com.apple.quarantine' extended attribute from files located in '/tmp/'. Removing this attribute is a common technique used by attackers to bypass macOS Gatekeeper security controls, allowing unauthorized or malicious applications to execute without user prompts.